ox 1.0.0-beta.11 → 1.0.0-beta.13

package/src/tempo/SignatureEnvelope.test.ts

@@ -3,6 +3,7 @@ import {
   Hex,
   P256,
   PublicKey,
+  Rlp,
   Secp256k1,
   Signature,
   WebAuthnP256,
@@ -1125,7 +1126,7 @@ describe('from', () => {
       ],
     })
 
-    test('behavior: derives `account`/`genesisConfigId` from `genesisConfig`', () => {
+    test('behavior: derives `account` from `genesisConfig`', () => {
       const envelope = SignatureEnvelope.from({
         genesisConfig,
         signatures: [SignatureEnvelope.from(signature_secp256k1)],
@@ -1134,7 +1135,6 @@ describe('from', () => {
       expect(envelope).toMatchObject({
         type: 'multisig',
         account: MultisigConfig.getAddress(genesisConfig),
-        genesisConfigId: MultisigConfig.toId(genesisConfig),
       })
       expect('genesisConfig' in envelope).toBe(false)
       expect((envelope as SignatureEnvelope.Multisig).init).toBeUndefined()
@@ -1171,19 +1171,16 @@ describe('from', () => {
       expect((envelope as SignatureEnvelope.Multisig).init).toEqual(otherConfig)
     })
 
-    test('behavior: `{account, genesisConfigId}` form still works', () => {
+    test('behavior: `{ account }` form still works', () => {
       const account = MultisigConfig.getAddress(genesisConfig)
-      const genesisConfigId = MultisigConfig.toId(genesisConfig)
       const envelope = SignatureEnvelope.from({
         account,
-        genesisConfigId,
         signatures: [SignatureEnvelope.from(signature_secp256k1)],
       })
 
       expect(envelope).toMatchObject({
         type: 'multisig',
         account,
-        genesisConfigId,
       })
     })
   })
@@ -1860,9 +1857,8 @@ describe('sortMultisigApprovals', () => {
     expect(recovered).toEqual(ascending.map((owner) => owner.address))
   })
 
-  test('behavior: `genesisConfig` and `{account, genesisConfigId}` produce identical ordering', () => {
+  test('behavior: `genesisConfig` and `{ account }` produce identical ordering', () => {
     const account = MultisigConfig.getAddress(genesisConfig)
-    const genesisConfigId = MultisigConfig.toId(genesisConfig)
     const signatures = owners.map((owner) => owner.signature)
 
     const fromConfig = SignatureEnvelope.sortMultisigApprovals({
@@ -1870,13 +1866,12 @@ describe('sortMultisigApprovals', () => {
       payload,
       signatures,
     })
-    const fromIds = SignatureEnvelope.sortMultisigApprovals({
+    const fromAccount = SignatureEnvelope.sortMultisigApprovals({
       account,
-      genesisConfigId,
       payload,
       signatures,
     })
-    expect(fromConfig).toEqual(fromIds)
+    expect(fromConfig).toEqual(fromAccount)
   })
 })
 
@@ -2883,8 +2878,6 @@ describe('CoercionError', () => {
 
 describe('multisig', () => {
   const account = '0x8ba6d26ff5c4e82ba0c8caf8c8ca794e1489a7ae'
-  const genesisConfigId =
-    '0x01781fe551182476f2422c759e82d81c92e3263737afbbad57def6e8b69d21f5'
 
   // P256 signatures do not carry `yParity` in the wire format, so use a clean
   // inner signature for round-trip equality checks.
@@ -2897,7 +2890,6 @@ describe('multisig', () => {
   const envelope = SignatureEnvelope.from({
     type: 'multisig',
     account,
-    genesisConfigId,
     signatures: [SignatureEnvelope.from(signature_secp256k1), innerP256],
   })
 
@@ -2906,11 +2898,32 @@ describe('multisig', () => {
     expect(serialized.startsWith('0x05')).toBe(true)
   })
 
+  test('serialize: wire shape is `0x05 || rlp([account, signatures])`', () => {
+    const deterministic = SignatureEnvelope.from({
+      type: 'multisig',
+      account,
+      signatures: [innerP256],
+    })
+    expect(SignatureEnvelope.serialize(deterministic)).toMatchInlineSnapshot(
+      `"0x05f89b948ba6d26ff5c4e82ba0c8caf8c8ca794e1489a7aef884b88201ccbb3485d4726235f13cb15ef394fb7158179fb7b1925eccec0147671090c52e77c3c53373cc1e3b05e7c23f609deb17cea8fe097300c45411237e9fe4166b35ad8ac16e167d6992c3e120d7f17d2376bc1cbcf30c46ba6dd00ce07303e742f511edf6ce1c32de66846f56afa7be1cbd729bc35750b6d0cdcf3ec9d75461aba001"`,
+    )
+  })
+
   test('serialize/deserialize round-trip', () => {
     const serialized = SignatureEnvelope.serialize(envelope)
     expect(SignatureEnvelope.deserialize(serialized)).toEqual(envelope)
   })
 
+  test('deserialize: rejects the empty `init` placeholder (`0x80`)', () => {
+    const withPlaceholder = Hex.concat(
+      '0x05',
+      Rlp.fromHex([account, [SignatureEnvelope.serialize(innerP256)], '0x']),
+    )
+    expect(() => SignatureEnvelope.deserialize(withPlaceholder)).toThrowError(
+      SignatureEnvelope.InvalidSerializedError,
+    )
+  })
+
   test('getType', () => {
     expect(SignatureEnvelope.getType(envelope)).toBe('multisig')
   })
@@ -2936,6 +2949,97 @@ describe('multisig', () => {
     ).toThrowError()
   })
 
+  test('assert: rejects keychain owner approvals', () => {
+    expect(() =>
+      SignatureEnvelope.assert({
+        type: 'multisig',
+        account,
+        signatures: [signature_keychain_secp256k1],
+      } as never),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: keychain owner approvals are not allowed.]`,
+    )
+  })
+
+  describe('nested approvals', () => {
+    const nestedAccount = '0x1111111111111111111111111111111111111111'
+    const nested = SignatureEnvelope.from({
+      type: 'multisig',
+      account: nestedAccount,
+      signatures: [innerP256],
+    })
+
+    test('serialize/deserialize round-trip with a nested multisig approval', () => {
+      const parent = SignatureEnvelope.from({
+        type: 'multisig',
+        account,
+        signatures: [innerP256, nested],
+      })
+      const serialized = SignatureEnvelope.serialize(parent)
+      expect(SignatureEnvelope.deserialize(serialized)).toEqual(parent)
+    })
+
+    test('assert: accepts the maximum nesting depth', () => {
+      const depth3 = SignatureEnvelope.from({
+        type: 'multisig',
+        account,
+        signatures: [
+          SignatureEnvelope.from({
+            type: 'multisig',
+            account: nestedAccount,
+            signatures: [nested],
+          }),
+        ],
+      })
+      expect(() => SignatureEnvelope.assert(depth3)).not.toThrowError()
+    })
+
+    test('assert: rejects nesting deeper than the maximum', () => {
+      const depth4 = SignatureEnvelope.from({
+        type: 'multisig',
+        account,
+        signatures: [
+          SignatureEnvelope.from({
+            type: 'multisig',
+            account: nestedAccount,
+            signatures: [
+              SignatureEnvelope.from({
+                type: 'multisig',
+                account: nestedAccount,
+                signatures: [nested],
+              }),
+            ],
+          }),
+        ],
+      })
+      expect(() =>
+        SignatureEnvelope.assert(depth4),
+      ).toThrowErrorMatchingInlineSnapshot(
+        `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: multisig nesting depth exceeds 3.]`,
+      )
+    })
+
+    test('assert: rejects nested approvals carrying `init`', () => {
+      expect(() =>
+        SignatureEnvelope.assert({
+          type: 'multisig',
+          account,
+          signatures: [
+            {
+              ...nested,
+              init: {
+                threshold: 1,
+                owners: [{ owner: nestedAccount, weight: 1 }],
+              },
+            },
+          ],
+        } as never),
+      ).toThrowErrorMatchingInlineSnapshot(
+        `[SignatureEnvelope.InvalidMultisigApprovalError: Invalid native multisig owner approval: nested multisig owner approvals cannot carry \`init\`.]`,
+      )
+    })
+  })
+
   describe('init (bootstrap)', () => {
     const init = {
       salt: `0x${'00'.repeat(32)}` as const,
@@ -2951,7 +3055,6 @@ describe('multisig', () => {
     const bootstrapEnvelope = SignatureEnvelope.from({
       type: 'multisig',
       account,
-      genesisConfigId,
       signatures: [SignatureEnvelope.from(signature_secp256k1), innerP256],
       init,
     })
@@ -2967,7 +3070,6 @@ describe('multisig', () => {
       const salted = SignatureEnvelope.from({
         type: 'multisig',
         account,
-        genesisConfigId,
         signatures: [SignatureEnvelope.from(signature_secp256k1), innerP256],
         init: { ...init, salt: `0x${'42'.repeat(32)}` },
       })
@@ -3021,7 +3123,6 @@ describe('multisig', () => {
         SignatureEnvelope.assert({
           type: 'multisig',
           account,
-          genesisConfigId,
           signatures: [],
           init: { threshold: 1, owners: [] },
         } as never),

package/src/tempo/SignatureEnvelope.ts

@@ -86,7 +86,6 @@ export type GetType<
               ? 'keychain'
               : envelope extends {
                     account: Address.Address
-                    genesisConfigId: `0x${string}`
                     signatures: any
                   }
                 ? 'multisig'
@@ -162,9 +161,10 @@ export type KeychainRpc = {
 /**
  * Native multisig signature (type `0x05`).
  *
- * Wraps a set of primitive owner approvals (secp256k1, p256, or webAuthn) over the
- * multisig owner approval digest. The transaction sender is the derived `account`,
- * authorized once the recovered owner weights meet the configured threshold.
+ * Wraps a set of owner approvals (secp256k1, p256, webAuthn, or nested
+ * multisig) over the multisig owner approval digest. The transaction sender is
+ * the derived `account`, authorized once the recovered owner weights meet the
+ * configured threshold.
  *
  * [TIP-1061](https://tips.sh/1061)
  */
@@ -172,9 +172,11 @@ export type Multisig<numberType = number> = {
   type: 'multisig'
   /** Native multisig account address. */
   account: Address.Address
-  /** Permanent config ID derived from the initial multisig config. */
-  genesisConfigId: Hex.Hex
-  /** Primitive owner approvals over the multisig owner approval digest. */
+  /**
+   * Owner approvals over the multisig owner approval digest. Each approval is
+   * either a primitive signature or a nested multisig signature (keychain
+   * approvals are invalid).
+   */
   signatures: readonly SignatureEnvelope<numberType>[]
   /**
    * Initial native multisig config for bootstrapping this account. Present only on
@@ -188,14 +190,8 @@ export type MultisigRpc = {
   type: 'multisig'
   account: Address.Address
   /**
-   * The permanent multisig config ID (TIP-1061 wire field `config_id`).
-   * Maps to `genesisConfigId` on the typed
-   * {@link ox#SignatureEnvelope.Multisig} envelope.
-   */
-  configId: Hex.Hex
-  /**
-   * Encoded primitive owner approvals (raw serialized signatures), matching the
-   * node's `Vec<Bytes>` representation.
+   * Encoded owner approvals (raw serialized signatures), matching the node's
+   * `Vec<Bytes>` representation.
    */
   signatures: readonly Serialized[]
   init?: MultisigConfig.Config | undefined
@@ -345,11 +341,24 @@ export function assert(envelope: PartialBy<SignatureEnvelope, 'type'>): void {
     const multisig = envelope as Multisig
     const missing: string[] = []
     if (!multisig.account) missing.push('account')
-    if (!multisig.genesisConfigId) missing.push('genesisConfigId')
     if (!Array.isArray(multisig.signatures)) missing.push('signatures')
     if (missing.length > 0)
       throw new MissingPropertiesError({ envelope, missing, type: 'multisig' })
-    for (const inner of multisig.signatures) assert(inner)
+    if (getNestingDepth(multisig) > MultisigConfig.maxNestingDepth)
+      throw new InvalidMultisigApprovalError({
+        reason: `multisig nesting depth exceeds ${MultisigConfig.maxNestingDepth}`,
+      })
+    for (const inner of multisig.signatures) {
+      if (inner.type === 'keychain')
+        throw new InvalidMultisigApprovalError({
+          reason: 'keychain owner approvals are not allowed',
+        })
+      if (inner.type === 'multisig' && inner.init)
+        throw new InvalidMultisigApprovalError({
+          reason: 'nested multisig owner approvals cannot carry `init`',
+        })
+      assert(inner)
+    }
     if (multisig.init) MultisigConfig.assert(multisig.init)
     return
   }
@@ -358,12 +367,22 @@ export function assert(envelope: PartialBy<SignatureEnvelope, 'type'>): void {
 export declare namespace assert {
   type ErrorType =
     | CoercionError
+    | InvalidMultisigApprovalError
     | MissingPropertiesError
     | MultisigConfig.assert.ErrorType
     | Signature.assert.ErrorType
     | Errors.GlobalErrorType
 }
 
+// Returns the deepest multisig path length within a multisig envelope.
+function getNestingDepth(envelope: Multisig): number {
+  let deepest = 0
+  for (const inner of envelope.signatures)
+    if (inner.type === 'multisig')
+      deepest = Math.max(deepest, getNestingDepth(inner))
+  return 1 + deepest
+}
+
 /**
  * Extracts the address of the signer from a {@link ox#SignatureEnvelope.SignatureEnvelope}.
  *
@@ -630,24 +649,26 @@ export function deserialize(value: Serialized): SignatureEnvelope {
   }
 
   if (typeId === serializedMultisigType) {
-    // Wire format: `0x05 || rlp([account, genesisConfigId, signatures, init])`. `init`
-    // is optional: absent when the element is missing or the `0x80` placeholder
-    // (decoded as the empty string `0x`), otherwise the bootstrap config list.
-    const [account, genesisConfigId, signatures, init] = Rlp.toHex(data) as [
-      Hex.Hex,
+    // Wire format: `0x05 || rlp([account, signatures, init?])`. `init` is a
+    // trailing optional: the bootstrap config list when present, otherwise
+    // omitted entirely (the empty `0x80` placeholder is rejected).
+    const [account, signatures, init] = Rlp.toHex(data) as [
       Hex.Hex,
       readonly Hex.Hex[],
       (Hex.Hex | MultisigConfig.Tuple)?,
     ]
+    if (typeof init !== 'undefined' && !Array.isArray(init))
+      throw new InvalidSerializedError({
+        reason:
+          'Invalid multisig `init`: expected the bootstrap config list or an omitted trailing element',
+        serialized,
+      })
     return {
       type: 'multisig',
       account,
-      genesisConfigId,
       signatures: signatures.map((signature) => deserialize(signature)),
-      ...(init && init !== '0x'
-        ? {
-            init: MultisigConfig.fromTuple(init as MultisigConfig.Tuple),
-          }
+      ...(init
+        ? { init: MultisigConfig.fromTuple(init as MultisigConfig.Tuple) }
         : {}),
     } satisfies Multisig
   }
@@ -786,9 +807,9 @@ export function deserialize(value: Serialized): SignatureEnvelope {
  * @example
  * ### Multisig (from genesis config)
  *
- * Pass `genesisConfig` to derive `account` and `genesisConfigId` automatically.
- * Set `init: true` to opt into bootstrap (uses `genesisConfig` as the
- * bootstrap `init`); omit `init` for subsequent (non-bootstrap) transactions.
+ * Pass `genesisConfig` to derive `account` automatically. Set `init: true` to
+ * opt into bootstrap (uses `genesisConfig` as the bootstrap `init`); omit
+ * `init` for subsequent (non-bootstrap) transactions.
  *
  * ```ts twoslash
  * import { Secp256k1 } from 'ox'
@@ -849,18 +870,12 @@ export function from<const value extends from.Value>(
       init?: MultisigConfig.Config | boolean | undefined
     }
     const { genesisConfig, init, ...rest } = multisig
-    // Derive `account`/`genesisConfigId` from `genesisConfig` when not provided
-    // explicitly.
+    // Derive `account` from `genesisConfig` when not provided explicitly.
     const account = (() => {
       if (rest.account) return rest.account
       if (genesisConfig) return MultisigConfig.getAddress(genesisConfig)
       return rest.account
     })()
-    const genesisConfigId = (() => {
-      if (rest.genesisConfigId) return rest.genesisConfigId
-      if (genesisConfig) return MultisigConfig.toId(genesisConfig)
-      return rest.genesisConfigId
-    })()
     // `init: true` opts into bootstrap using the supplied `genesisConfig`.
     // Otherwise, `init` is treated as the explicit bootstrap config (or
     // omitted).
@@ -868,7 +883,6 @@ export function from<const value extends from.Value>(
     return {
       ...rest,
       account,
-      genesisConfigId,
       signatures: rest.signatures.map((signature) => from(signature)),
       // Normalize the bootstrap config (sorts owners, defaults the salt) so the
       // in-memory envelope matches what `deserialize` reconstructs.
@@ -920,9 +934,9 @@ export declare namespace from {
   }
 
   /**
-   * Multisig envelope input variant where `account` and `genesisConfigId` are derived
-   * from the supplied `genesisConfig`. Pass `init: true` to opt into bootstrap
-   * (uses `genesisConfig` as the bootstrap `init`); omit `init` for subsequent
+   * Multisig envelope input variant where `account` is derived from the
+   * supplied `genesisConfig`. Pass `init: true` to opt into bootstrap (uses
+   * `genesisConfig` as the bootstrap `init`); omit `init` for subsequent
    * (non-bootstrap) transactions.
    */
   type MultisigFromGenesisConfig = {
@@ -1063,17 +1077,12 @@ export function fromRpc(envelope: SignatureEnvelopeRpc): SignatureEnvelope {
 
   if (
     envelope.type === 'multisig' ||
-    ('account' in envelope &&
-      'configId' in envelope &&
-      'signatures' in envelope)
+    ('account' in envelope && 'signatures' in envelope)
   ) {
     const multisig = envelope as MultisigRpc
     return {
       type: 'multisig',
       account: multisig.account,
-      // Map RPC wire field `configId` (TIP-1061 spec name) to the typed
-      // envelope's `genesisConfigId`.
-      genesisConfigId: multisig.configId,
       // Owner approvals are raw serialized signatures (node `Vec<Bytes>`).
       signatures: multisig.signatures.map((signature) =>
         deserialize(signature),
@@ -1164,8 +1173,7 @@ export function getType<
 
   // Detect Multisig signature
   if (
-    (('account' in envelope && 'genesisConfigId' in envelope) ||
-      'genesisConfig' in envelope) &&
+    ('account' in envelope || 'genesisConfig' in envelope) &&
     'signatures' in envelope
   )
     return 'multisig' as never
@@ -1269,17 +1277,15 @@ export function serialize(
 
   if (type === 'multisig') {
     const multisig = envelope as Multisig
-    // Format: `0x05 || rlp([account, genesisConfigId, signatures, init])`, where each
-    // owner approval is an encoded primitive signature. `init` is the bootstrap
-    // config (an RLP list) when present, otherwise the canonical empty-string
-    // placeholder (`0x` → RLP `0x80`).
+    // Format: `0x05 || rlp([account, signatures, init?])`, where each owner
+    // approval is an encoded signature. `init` is a trailing optional: the
+    // bootstrap config list when present, otherwise omitted entirely.
     return Hex.concat(
       serializedMultisigType,
       Rlp.fromHex([
         multisig.account,
-        multisig.genesisConfigId,
         multisig.signatures.map((signature) => serialize(signature)),
-        multisig.init ? MultisigConfig.toTuple(multisig.init) : '0x',
+        ...(multisig.init ? [MultisigConfig.toTuple(multisig.init)] : []),
       ]),
       options.magic ? magicBytes : '0x',
     )
@@ -1307,10 +1313,10 @@ export declare namespace serialize {
  * ({@link ox#MultisigConfig.(getSignPayload:function)}), so the signer of
  * every approval is recovered against that digest and the list is sorted by the
  * recovered owner address. Works for any owner key type (secp256k1, p256,
- * webAuthn, keychain).
+ * webAuthn).
  *
- * Config updates never change `account`/`genesisConfigId`, so the genesis
- * config is the correct input even for post-update transactions.
+ * Config updates never change `account`, so the genesis config is the correct
+ * input even for post-update transactions.
  *
  * @example
  * ```ts twoslash
@@ -1370,12 +1376,7 @@ export function sortMultisigApprovals(
   const digest = MultisigConfig.getSignPayload(
     'genesisConfig' in value && value.genesisConfig
       ? { payload, genesisConfig: value.genesisConfig }
-      : {
-          payload,
-          account: (value as { account: Address.Address }).account,
-          genesisConfigId: (value as { genesisConfigId: Hex.Hex })
-            .genesisConfigId,
-        },
+      : { payload, account: (value as { account: Address.Address }).account },
   )
   // Recover each signer once (decorate–sort–undecorate) rather than inside the
   // comparator.
@@ -1392,20 +1393,17 @@ export declare namespace sortMultisigApprovals {
   type Value = {
     /** The inner transaction sign payload (`tx.signature_hash()`). */
     payload: Hex.Hex | Bytes.Bytes
-    /** The primitive owner approvals to order. */
+    /** The owner approvals to order. */
     signatures: readonly SignatureEnvelope[]
   } & OneOf<
     | {
         /** The native multisig account address. */
         account: Address.Address
-        /** The permanent config ID. */
-        genesisConfigId: Hex.Hex
       }
     | {
         /**
          * The initial multisig config (the bootstrap config that derived the
-         * permanent `account` and `genesisConfigId`). Used to derive both values
-         * automatically.
+         * permanent `account`). Used to derive the account automatically.
          */
         genesisConfig: MultisigConfig.Config
       }
@@ -1493,9 +1491,6 @@ export function toRpc(envelope: toRpc.Input): SignatureEnvelopeRpc {
     return {
       type: 'multisig',
       account: multisig.account,
-      // Map the typed envelope's `genesisConfigId` to the RPC wire field
-      // `configId` (TIP-1061 spec name).
-      configId: multisig.genesisConfigId,
       // Owner approvals are raw serialized signatures (node `Vec<Bytes>`).
       signatures: multisig.signatures.map((signature) => serialize(signature)),
       ...(multisig.init ? { init: multisig.init } : {}),
@@ -1780,6 +1775,16 @@ export class InvalidSerializedError extends Errors.BaseError {
   }
 }
 
+/**
+ * Error thrown when a native multisig owner approval is invalid.
+ */
+export class InvalidMultisigApprovalError extends Errors.BaseError {
+  override readonly name = 'SignatureEnvelope.InvalidMultisigApprovalError'
+  constructor({ reason }: { reason: string }) {
+    super(`Invalid native multisig owner approval: ${reason}.`)
+  }
+}
+
 /**
  * Error thrown when a signature envelope fails to verify.
  */